oss-security - Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <13391.1759073438@cvs.openbsd.org>
Date: Sun, 28 Sep 2025 09:30:38 -0600
From: "Theo de Raadt" <deraadt@...nbsd.org>
To: "Adiletta, Andrew" <ajadiletta@....edu>
cc: Damien Miller <djm@...drot.org>, Solar Designer <solar@...nwall.com>,
    "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
    "openssh@...nssh.com" <openssh@...nssh.com>,
    "Tol,
    Caner" <mtol@....edu>, "Sunar, Berk" <sunar@....edu>,
    "Doroz,
    Yarkin" <ydoroz@....edu>,
    "Todd C. Miller" <Todd.Miller@...rtesan.com>,
    "pgut001@...auckland.ac.nz" <pgut001@...auckland.ac.nz>
Subject: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH

Adiletta, Andrew <ajadiletta@....edu> wrote:

> As far as SSH is concerned there are ways to handle synchronization (we outline them
> in the paper). The POC concept we present in the paper should be acceptable to anybody
> who is fluent in the Rowhammer/microarch attack literature.

I disagree.  I believe your simulation is fake. 

> There are numerous results
> where the target is slowed down to solve synchronization. We don’t brush aside or hide
> the synchronization issue in the paper but discuss it explicitly.

Then why don't you produce exactly such a synchronization without any source code
changes, in any actual distribution build system??

It's not that you brush or hide; it is that you overplay the seriousness by
providing an entirely synthetic example.

Unless your document is amended, non-astute readers in the future will
read this as "serious OpenSSH problem" instead of "entirely synthetic
and fake demonstration".

I think you made a mistake choosing OpenSSH as a demonstration target
for reputational benefit, that hand-waving about realistic attacks when
you didn't execute one, and I'm calling you out for what is effectively
academic malpractice.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.